Notifications
Clear all
Topic starter
24/06/2026 9:09 pm
TL;DR: DSPM is positioned as a way to continuously discover, classify, and secure sensitive data across cloud and hybrid environments as AI-driven threats and shadow data increase, according to Netwrix and the 2025 Cybersecurity Trends Report. The deeper issue is that visibility into data exposure now determines whether IAM, DAG, and PAM can actually reduce risk or merely document it.
NHIMG editorial — based on content published by Netwrix: How DSPM Tackles AI and Cloud Security Threats
By the numbers:
- 49% of workloads already in the cloud.
- 26% of businesses report struggling with inconsistent tools and processes.
- 73% of organizations identified data security as their top priority in 2025.
Questions worth separating out
Q: How should security teams use DSPM to improve cloud data governance?
A: Security teams should use DSPM to identify where sensitive data resides, who can reach it, and which repositories create the highest exposure.
Q: Why do cloud and SaaS environments make data security harder to govern?
A: Cloud and SaaS environments increase the number of places sensitive data can land, move, and be copied without consistent ownership.
Q: What breaks when organisations manage access without data classification?
A: Access governance breaks down when teams can see entitlement but not sensitivity.
Practitioner guidance
- Baseline sensitive data before revisiting access models Run discovery across cloud, SaaS, and unmanaged repositories first, then use the results to re-evaluate which identities truly need access to which datasets.
- Tie entitlement reviews to data sensitivity Require IAM, DAG, and PAM reviewers to see classification results alongside entitlements so they can judge whether an access path is acceptable in context.
- Prioritise shadow data repositories with business impact Focus remediation on repositories that contain regulated or mission-critical information, especially where access is broad and inventory confidence is low.
What's in the full article
Netwrix's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step DSPM workflow details for discovery, classification, and risk prioritisation across cloud and hybrid estates.
- How the article positions DSPM alongside IAM, DAG, and PAM in day-to-day security operations.
- The article's own 2025 survey findings and interpretation of AI-driven data security pressure.
- Vendor-specific product framing and implementation context for Netwrix DSPM.
👉 Read Netwrix's analysis of how DSPM tackles AI and cloud security threats →
DSPM, shadow data, and AI-era cloud risk: are your controls keeping up?
Explore further
25/06/2026 6:11 am
Data visibility is now an identity control, not a separate data problem. When organisations cannot tell what sensitive data sits behind an entitlement, IAM and PAM decisions become incomplete by design. DSPM adds the sensitivity layer that access governance has historically lacked, which means identity programmes that ignore data context will keep approving technically valid but operationally unsafe access. The implication is that entitlement review without data classification is no longer a full control.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: How can organisations tell whether DSPM is reducing real risk?
A: The clearest signals are lower volumes of unclassified data, fewer over-permissioned exposures to sensitive repositories, and faster remediation of cloud and SaaS findings. If DSPM only increases visibility but does not change access decisions, the programme has become descriptive rather than protective. Measurable reduction in high-risk exposure is the real test.
👉 Read our full editorial: DSPM and cloud data security: what AI-era teams need to know
